CVE-2026-8647

MediumCVSS 4.8/10Last modified Jul 23, 2026

Description

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.

The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864719.3An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary CVE-2026-864724.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, CVE-2026-864739.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting CVE-2026-864747.7The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, a CVE-2026-864755.3The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity co CVE-2026-864768.4A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta meta CVE-2026-864789.8In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeo CVE-2026-864798.1In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourc CVE-2026-864809.8In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges CVE-2026-864814.3In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons CVE-2026-864828.8In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation CVE-2026-864835.4In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible